A UK-headquartered trading group discovers, during a routine internal audit, that a payment was processed to a counterparty that had been listed under UK financial sanctions for several weeks before the transfer cleared. The transaction is modest in value. The breach appears unintentional. Two questions land immediately on the general counsel's desk: what does OFSI expect next, and – because the group also holds an Australian operating licence and the same counterparty appears on the Australian autonomous sanctions list – what does the Australian Autonomous Sanctions regime require in parallel?
As of March 2026, OFSI and the Australian autonomous sanctions regime both impose civil and criminal liability for sanctions breaches, but they diverge sharply on how that liability is triggered, how a voluntary disclosure affects the outcome, and how the enforcement process unfolds. For a business with exposure under both regimes, managing post-breach enforcement risk requires two separate compliance tracks running simultaneously.
This analysis maps the key divergences across the enforcement lifecycle – from the moment of discovery through to penalty determination – and identifies the practical risk flags that counsel encounters most frequently in cross-border matters.
What is the legal basis for enforcement action under each regime?
OFSI derives its enforcement authority from the Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and the thematic regulations made under it, which create both civil monetary penalty powers and the gateway to criminal prosecution. SAMLA gives OFSI the power to impose a civil monetary penalty where it is satisfied, on the balance of probabilities, that a person has breached a prohibition and knew, or had reasonable cause to suspect, that the breach was occurring. The criminal threshold is higher and requires proof beyond reasonable doubt, but OFSI can refer matters to the Crown Prosecution Service when the facts warrant it.
Australia's regime rests on the Autonomous Sanctions Act 2011 and the Autonomous Sanctions Regulations, administered by the Department of Foreign Affairs and Trade ("DFAT"). Breaches carry criminal liability under the Act itself; there is no parallel civil-penalty track of the kind that OFSI operates. That structural difference is not a technicality. In practice it means that in Australia the enforcement bar goes straight to the criminal standard, whereas in the UK a regulator can impose a significant financial penalty without putting the matter to a court at all.
Why does that matter for a cross-border business? Because the absence of a civil track in Australia means that DFAT's referral to the Australian Federal Police is the primary escalation route, whereas OFSI's civil-penalty power gives it a self-contained enforcement tool that it uses before – and often instead of – a criminal referral.
How does the voluntary self-disclosure process differ?
Under OFSI, a voluntary self-disclosure (a proactive report to the regulator of an apparent breach before OFSI discovers it independently) is a formal mitigating factor in the civil-penalty process. OFSI's enforcement guidance expressly treats prompt self-reporting as capable of reducing the penalty outcome, and in our experience the quality and timing of the disclosure carry significant weight in OFSI's assessment of the case. Disclosure should include the factual background, the size and nature of the breach, the steps taken to stop it, and the remedial action under way.
Australia does not operate an equivalent codified voluntary self-disclosure programme under the Autonomous Sanctions Act. DFAT encourages reporting through its advisory mechanisms, but there is no published guidance that attaches a defined mitigating credit to pre-emptive disclosure in the way that OFSI's guidance does. In practice, a business that discloses voluntarily to DFAT may receive a more measured response – prosecutors and regulators in any jurisdiction tend to treat cooperation positively – but the outcome is less predictable and less structurally protected than under the OFSI regime.
That asymmetry creates a real dilemma for a dual-exposed business. The case for early disclosure to OFSI is strong and well-supported by the guidance. The case for equivalent disclosure to DFAT requires a different analysis: what is the likelihood that the breach comes to DFAT's attention independently? Is the counterparty the subject of active regulatory scrutiny in Australia? Does the business have ongoing dealings in Australia that would surface the payment in a future examination? In our experience, these questions must be addressed together, not sequentially.
The position above covers the standard case. Your facts – the counterparty, the value of the transaction, the route of the funds, and the regime in play – change the analysis. To discuss your specific situation with a sanctions lawyer, contact Calder & Vance at info@caldervance.com.
What is the ownership and control test, and how does it affect breach exposure?
A breach does not always involve a direct transaction with a listed person. Under OFSI's ownership and control test – the UK and EU standard for whether a non-listed entity is caught through a listed person's interest in it – an entity can be caught where a designated person holds a majority ownership stake or exercises control, even without reaching the 50 percent or more threshold that triggers the US rule automatically. OFSI applies a broader, fact-specific control analysis. That means businesses that screened a counterparty against the Consolidated List and found no direct match can still be in breach if a designated person controls the counterparty through means other than formal majority ownership.
Australia does not publish detailed regulatory guidance on an equivalent ownership-and-control doctrine of the same kind. The Australian list prohibition attaches directly to the listed person and to actions that are, or knowingly facilitate, a breach. The analysis of whether an unlisted entity is caught tends to be a factual question about whether the transaction ultimately benefits a listed person, rather than a formal ownership-and-control test applied to the entity itself.
For a business that holds both UK and Australian exposure, this matters at the breach-identification stage, not only at the penalty stage. An entity that is not on the Australian list but that would be caught under OFSI's ownership and control analysis may generate OFSI liability for what the business believed was a compliant Australian-law transaction. The screening tool that passed the counterparty for Australian purposes may have missed the UK risk entirely.
How does the penalty calculus differ between the two regimes?
OFSI can impose a civil monetary penalty at the higher of a fixed maximum or a percentage of the transaction value, under the powers set by SAMLA and the relevant thematic regulations. The civil standard – balance of probabilities, with knowledge or reasonable cause to suspect – is the operative test for the penalty, not criminal proof. OFSI publishes its enforcement decisions and, since the introduction of a revised enforcement approach, has demonstrated willingness to issue penalties in cases where the breach involved an intermediary, a payment system, or an indirect benefit to a designated person.
In Australia, because enforcement runs through the criminal track, the penalty is set by the Autonomous Sanctions Act's penalty provisions, applied by a court. There is no OFSI-style administrative penalty. A conviction under the Act carries a maximum penalty expressed in penalty units under Australian law. The practical effect is that a proven breach in Australia is a criminal conviction, not an administrative finding – a materially different reputational and governance consequence for a listed company or a licensed financial institution.
For a compliance officer preparing a board briefing after a suspected breach, these differences carry direct implications. Under OFSI, the board is assessing the risk of a civil penalty that will become public (OFSI publishes decisions) and the residual risk of a criminal referral. Under the Australian regime, the board is assessing, from the outset, whether the matter could result in a prosecution. The framing of the internal investigation, the privilege position over legal advice, and the decision about whether to engage external counsel should all reflect that structural difference.
What are the reporting obligations, and do they differ?
OFSI imposes a reporting obligation on certain persons – including financial institutions and other regulated businesses – to report a known or suspected breach to OFSI as soon as practicable. That obligation is separate from and in addition to any voluntary self-disclosure decision. Failure to report when the obligation applies is itself a breach. The obligation covers information that comes to the reporter in the course of carrying on a relevant business, and the time window is short. In our experience, one of the most common post-breach errors is a delay in assessing whether the statutory reporting obligation applies, because the internal investigation is still running.
Australia does not operate an equivalent mandatory reporting requirement under the Autonomous Sanctions Act of the kind that OFSI imposes on regulated entities. There is a general obligation not to deal with or facilitate a breach, and disclosure of a suspected breach may be encouraged, but the structural duty-to-report that OFSI mandates for regulated businesses does not have a direct Australian equivalent.
For a UK-regulated financial institution with Australian operations, this asymmetry is operationally important. The OFSI reporting clock may have started running at the point the institution's London compliance team identified the issue, regardless of whether the Australian side of the operation has completed its own review. Waiting for a unified internal picture before notifying OFSI can itself create a secondary breach risk.
If a transaction has already been flagged, or a filing has been refused, an early review by a compliance counsel can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss an assessment.
Where does the enforcement process diverge most sharply in practice?
The divergence that practitioners encounter most often is the difference in process architecture: OFSI runs a self-contained administrative enforcement process with published stages, whereas Australia's enforcement path runs through the criminal justice system from the moment of referral. That has three practical consequences.
First, cooperation with OFSI during an investigation – providing documents promptly, engaging with the case officer, and producing a credible remediation plan – is part of the formal mitigation calculation. Under OFSI's published approach, the quality of cooperation is assessed alongside the seriousness of the breach and the strength of the compliance programme. In the Australian criminal process, cooperation with investigators is also beneficial, but the formal framework for assessing it is the criminal procedure rules and any prosecutorial discretion guidelines, not a published penalty-reduction matrix.
Second, the decision about remediation moves at a different pace. OFSI expects, and credits, prompt remediation – stopping further transactions, applying blocking measures, fixing the screening gap that allowed the breach. A business that can show OFSI a completed remediation plan at the time of disclosure is in a substantially better position than one that has not started the process. In the Australian context, remediation remains important as a demonstration of good faith, but it operates as a mitigating factor in any prosecutorial and sentencing decision rather than as a formal input into a regulatory assessment.
Third, record-keeping underpins both regimes but is treated differently. OFSI expects businesses to maintain records of compliance decisions, screening results, and any blocking steps for a defined period. Australia's customs and export obligations carry their own record-keeping duties, and a business that cannot reconstruct the transaction trail will be unable to present an effective defence under either regime.
In a recent matter, a financial services group with UK and Australian operations identified a payment instruction that had been processed against a counterparty appearing on both the UK and Australian lists. We assessed the applicable obligations under each regime, advised on the OFSI reporting clock, assisted in preparing the voluntary self-disclosure to OFSI, and supported the group in producing a remediation plan for presentation to both authorities. The matter illustrated, precisely, how the different timelines and process requirements of the two regimes can create parallel pressures that must be managed concurrently rather than in sequence.
Common risk flags and when to involve counsel
Several risk patterns appear repeatedly in post-breach matters across both regimes, and identifying them early is what separates a managed enforcement process from a reactive one.
The first is screening delay. A counterparty may have been listed between the date the contract was signed and the date the payment cleared. Businesses that screen only at onboarding, and not at the point of each transaction, routinely miss this window. OFSI treats the absence of transaction-level screening as a compliance weakness that aggravates the seriousness of the breach.
The second is the indirect-benefit question. A payment that does not go directly to a listed person can still breach a prohibition if it generates a benefit for that person – through a contractual obligation, a dividend, a repayment, or a fee-splitting arrangement. Identifying whether the counterparty's own payment obligations flow up to a designated person requires an ownership analysis, not just a name-match.
The third is the multi-regime notification sequence. A business with operations in multiple jurisdictions may be subject to reporting or notification obligations in more than one place. The OFSI obligation, the UK anti-money-laundering suspicious activity report route, and any DFAT engagement in Australia may all have different triggers, different timelines, and different privilege implications. The sequencing of those notifications should be decided with counsel before any of them are sent.
A common misconception is that a small-value breach will not attract enforcement attention. OFSI's published decisions include cases where the monetary value of the underlying transaction was modest; the enforcement response turned on the absence of a credible compliance programme and the failure to self-report. Value is one factor, not the whole analysis. Does your business have a programme that would survive a post-breach review by OFSI?
Related practices
- Apparent Violation Assessment – EU – initial scoping and advice on apparent violations under EU sanctions regulations
- Post-breach Remediation: EU vs SECO – comparative analysis of remediation expectations under EU and Swiss regimes
- Post-breach Remediation: OFAC vs Canada – practitioner comparison of OFAC and Canadian post-breach requirements